Malware Analysis Report

2024-11-13 19:09

Sample ID 231111-1f2jtscd48
Target 35ab06be2e6fc0fc00327764f68a4f3fc27c1f1f0ad39f42615c82f0a9ce5312
SHA256 35ab06be2e6fc0fc00327764f68a4f3fc27c1f1f0ad39f42615c82f0a9ce5312
Tags
glupteba mystic redline smokeloader stealc zgrat taiga up3 backdoor google dropper evasion infostealer loader persistence phishing rat stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

35ab06be2e6fc0fc00327764f68a4f3fc27c1f1f0ad39f42615c82f0a9ce5312

Threat Level: Known bad

The file 35ab06be2e6fc0fc00327764f68a4f3fc27c1f1f0ad39f42615c82f0a9ce5312 was found to be: Known bad.

Malicious Activity Summary

glupteba mystic redline smokeloader stealc zgrat taiga up3 backdoor google dropper evasion infostealer loader persistence phishing rat stealer trojan

SmokeLoader

RedLine

Detected google phishing page

Mystic

Detect Mystic stealer payload

Stealc

ZGRat

Glupteba payload

RedLine payload

Detect ZGRat V1

Glupteba

Downloads MZ/PE file

Stops running service(s)

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

AutoIT Executable

Launches sc.exe

Drops file in Windows directory

Program crash

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Checks SCSI registry key(s)

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious use of SetWindowsHookEx

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-11-11 21:36

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-11-11 21:36

Reported

2023-11-11 21:39

Platform

win10-20231020-en

Max time kernel

7s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\35ab06be2e6fc0fc00327764f68a4f3fc27c1f1f0ad39f42615c82f0a9ce5312.exe"

Signatures

Detect Mystic stealer payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A

Detected google phishing page

phishing google

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Mystic

stealer mystic

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Stealc

stealer stealc

ZGRat

rat zgrat

Downloads MZ/PE file

Stops running service(s)

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1go07xH9.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ty1lD96.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\LW2uf85.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uI1ds80.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\35ab06be2e6fc0fc00327764f68a4f3fc27c1f1f0ad39f42615c82f0a9ce5312.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1000 set thread context of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2IX3959.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rescache\_merged\3720402701\2219095117.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
File opened for modification C:\Windows\Debug\ESE.TXT C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
File created C:\Windows\rescache\_merged\3720402701\2219095117.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
File created C:\Windows\rescache\_merged\3720402701\2219095117.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
File created C:\Windows\rescache\_merged\3720402701\2219095117.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7NA21Vg.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7NA21Vg.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7NA21Vg.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\system32\browser_broker.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d656a622e714da01 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ea40d122e714da01 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 9fb40523e714da01 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b73a4d23e714da01 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 4fde7424e714da01 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 5a507f23e714da01 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7NA21Vg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7NA21Vg.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 360 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\35ab06be2e6fc0fc00327764f68a4f3fc27c1f1f0ad39f42615c82f0a9ce5312.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ty1lD96.exe
PID 360 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\35ab06be2e6fc0fc00327764f68a4f3fc27c1f1f0ad39f42615c82f0a9ce5312.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ty1lD96.exe
PID 360 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\35ab06be2e6fc0fc00327764f68a4f3fc27c1f1f0ad39f42615c82f0a9ce5312.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ty1lD96.exe
PID 2080 wrote to memory of 4248 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ty1lD96.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\LW2uf85.exe
PID 2080 wrote to memory of 4248 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ty1lD96.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\LW2uf85.exe
PID 2080 wrote to memory of 4248 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ty1lD96.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\LW2uf85.exe
PID 4248 wrote to memory of 3080 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\LW2uf85.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uI1ds80.exe
PID 4248 wrote to memory of 3080 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\LW2uf85.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uI1ds80.exe
PID 4248 wrote to memory of 3080 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\LW2uf85.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uI1ds80.exe
PID 3080 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uI1ds80.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1go07xH9.exe
PID 3080 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uI1ds80.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1go07xH9.exe
PID 3080 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uI1ds80.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1go07xH9.exe
PID 3080 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uI1ds80.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2IX3959.exe
PID 3080 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uI1ds80.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2IX3959.exe
PID 3080 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uI1ds80.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2IX3959.exe
PID 1000 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2IX3959.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1000 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2IX3959.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1000 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2IX3959.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1000 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2IX3959.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1000 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2IX3959.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1000 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2IX3959.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1000 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2IX3959.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1000 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2IX3959.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1000 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2IX3959.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1000 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2IX3959.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4248 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\Broom.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7NA21Vg.exe
PID 4248 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\Broom.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7NA21Vg.exe
PID 4248 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\Broom.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7NA21Vg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\35ab06be2e6fc0fc00327764f68a4f3fc27c1f1f0ad39f42615c82f0a9ce5312.exe

"C:\Users\Admin\AppData\Local\Temp\35ab06be2e6fc0fc00327764f68a4f3fc27c1f1f0ad39f42615c82f0a9ce5312.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ty1lD96.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ty1lD96.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\LW2uf85.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\LW2uf85.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uI1ds80.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uI1ds80.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1go07xH9.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1go07xH9.exe

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca

C:\Windows\system32\browser_broker.exe

C:\Windows\system32\browser_broker.exe -Embedding

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2IX3959.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2IX3959.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7NA21Vg.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7NA21Vg.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 568

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\8yo518RN.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\8yo518RN.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\9mE4sQ5.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\9mE4sQ5.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Users\Admin\AppData\Local\Temp\C9A4.exe

C:\Users\Admin\AppData\Local\Temp\C9A4.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5516 -s 756

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Users\Admin\AppData\Local\Temp\2E5.exe

C:\Users\Admin\AppData\Local\Temp\2E5.exe

C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

"C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\BDF.exe

C:\Users\Admin\AppData\Local\Temp\BDF.exe

C:\Users\Admin\AppData\Local\Temp\Broom.exe

C:\Users\Admin\AppData\Local\Temp\Broom.exe

C:\Users\Admin\AppData\Local\Temp\forc.exe

"C:\Users\Admin\AppData\Local\Temp\forc.exe"

C:\Users\Admin\AppData\Local\Temp\latestX.exe

"C:\Users\Admin\AppData\Local\Temp\latestX.exe"

C:\Users\Admin\AppData\Local\Temp\BDF.exe

C:\Users\Admin\AppData\Local\Temp\BDF.exe

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\7950.exe

C:\Users\Admin\AppData\Local\Temp\7950.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Users\Admin\AppData\Local\Temp\F363.exe

C:\Users\Admin\AppData\Local\Temp\F363.exe

C:\Users\Admin\AppData\Local\Temp\F7C9.exe

C:\Users\Admin\AppData\Local\Temp\F7C9.exe

C:\Users\Admin\AppData\Local\Temp\FA89.exe

C:\Users\Admin\AppData\Local\Temp\FA89.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6824 -s 756

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

Network

Country Destination Domain Proto
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www.facebook.com udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 157.240.247.35:443 www.facebook.com tcp
NL 157.240.247.35:443 www.facebook.com tcp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 twitter.com udp
US 8.8.8.8:53 store.steampowered.com udp
NL 104.85.0.101:443 store.steampowered.com tcp
NL 104.85.0.101:443 store.steampowered.com tcp
US 104.244.42.65:443 twitter.com tcp
US 104.244.42.65:443 twitter.com tcp
US 8.8.8.8:53 254.3.248.8.in-addr.arpa udp
US 8.8.8.8:53 35.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 steamcommunity.com udp
JP 23.207.106.113:443 steamcommunity.com tcp
JP 23.207.106.113:443 steamcommunity.com tcp
US 8.8.8.8:53 www.epicgames.com udp
US 8.8.8.8:53 101.0.85.104.in-addr.arpa udp
US 8.8.8.8:53 65.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 113.106.207.23.in-addr.arpa udp
US 8.8.8.8:53 www.paypal.com udp
US 8.8.8.8:53 community.cloudflare.steamstatic.com udp
US 172.64.145.151:443 community.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 community.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 community.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 community.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 community.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 community.cloudflare.steamstatic.com tcp
US 3.224.228.139:443 www.epicgames.com tcp
US 3.224.228.139:443 www.epicgames.com tcp
US 8.8.8.8:53 151.145.64.172.in-addr.arpa udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 157.240.5.10:443 static.xx.fbcdn.net tcp
US 157.240.5.10:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 abs.twimg.com udp
US 8.8.8.8:53 store.cloudflare.steamstatic.com udp
US 104.18.42.105:443 store.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 store.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 store.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 store.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 store.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 store.cloudflare.steamstatic.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 8.8.8.8:53 facebook.com udp
US 157.240.5.35:443 facebook.com tcp
US 157.240.5.35:443 facebook.com tcp
US 8.8.8.8:53 ocsp.r2m02.amazontrust.com udp
US 18.238.246.206:80 ocsp.r2m02.amazontrust.com tcp
US 8.8.8.8:53 139.228.224.3.in-addr.arpa udp
US 8.8.8.8:53 10.5.240.157.in-addr.arpa udp
US 8.8.8.8:53 136.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 192.15.239.18.in-addr.arpa udp
US 8.8.8.8:53 105.42.18.104.in-addr.arpa udp
US 8.8.8.8:53 141.21.199.152.in-addr.arpa udp
US 8.8.8.8:53 80.41.65.18.in-addr.arpa udp
US 8.8.8.8:53 35.5.240.157.in-addr.arpa udp
US 8.8.8.8:53 206.246.238.18.in-addr.arpa udp
US 8.8.8.8:53 fbcdn.net udp
US 157.240.5.35:443 fbcdn.net tcp
US 157.240.5.35:443 fbcdn.net tcp
US 104.244.42.65:443 twitter.com tcp
US 104.244.42.65:443 twitter.com tcp
US 151.101.1.21:443 www.paypal.com tcp
US 151.101.1.21:443 www.paypal.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 21.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 14.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 static-assets-prod.unrealengine.com udp
US 157.240.5.35:443 fbsbx.com tcp
US 157.240.5.35:443 fbsbx.com tcp
US 18.239.36.22:443 static-assets-prod.unrealengine.com tcp
US 18.239.36.22:443 static-assets-prod.unrealengine.com tcp
US 8.8.8.8:53 tracking.epicgames.com udp
US 34.195.142.151:443 tracking.epicgames.com tcp
US 34.195.142.151:443 tracking.epicgames.com tcp
US 8.8.8.8:53 22.36.239.18.in-addr.arpa udp
US 8.8.8.8:53 151.142.195.34.in-addr.arpa udp
US 8.8.8.8:53 www.paypalobjects.com udp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 8.8.8.8:53 25.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 numpersb.fun udp
US 8.8.8.8:53 killredls.pw udp
US 172.67.209.38:80 killredls.pw tcp
US 8.8.8.8:53 38.209.67.172.in-addr.arpa udp
RU 5.42.92.51:19057 tcp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 i.ytimg.com udp
NL 142.251.36.54:443 i.ytimg.com tcp
NL 142.251.36.54:443 i.ytimg.com tcp
US 8.8.8.8:53 54.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 172.67.209.38:80 killredls.pw tcp
US 8.8.8.8:53 106.208.58.216.in-addr.arpa udp
US 8.8.8.8:53 t.paypal.com udp
JP 23.207.106.113:443 steamcommunity.com tcp
JP 23.207.106.113:443 steamcommunity.com tcp
US 151.101.1.35:443 t.paypal.com tcp
US 151.101.1.35:443 t.paypal.com tcp
US 8.8.8.8:53 35.1.101.151.in-addr.arpa udp
US 172.67.209.38:80 killredls.pw tcp
US 172.67.209.38:80 killredls.pw tcp
US 172.67.209.38:80 killredls.pw tcp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 52.168.117.173:443 watson.telemetry.microsoft.com tcp
US 172.67.209.38:80 killredls.pw tcp
US 172.67.209.38:80 killredls.pw tcp
US 172.67.209.38:80 killredls.pw tcp
US 8.8.8.8:53 173.117.168.52.in-addr.arpa udp
US 172.67.209.38:80 killredls.pw tcp
US 52.168.117.173:443 watson.telemetry.microsoft.com tcp
US 172.67.209.38:80 killredls.pw tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
NL 104.85.0.101:443 store.steampowered.com tcp
NL 104.85.0.101:443 store.steampowered.com tcp
US 172.67.209.38:80 killredls.pw tcp
US 172.67.209.38:80 killredls.pw tcp
US 8.8.8.8:53 131.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 c.paypal.com udp
US 151.101.1.21:443 c.paypal.com tcp
US 151.101.1.21:443 c.paypal.com tcp
US 172.67.209.38:80 killredls.pw tcp
US 157.240.5.10:443 static.xx.fbcdn.net tcp
US 157.240.5.10:443 static.xx.fbcdn.net tcp
US 172.67.209.38:80 killredls.pw tcp
US 172.67.209.38:80 killredls.pw tcp
US 192.55.233.1:443 tcp
US 192.55.233.1:443 tcp
US 172.67.209.38:80 killredls.pw tcp
US 172.67.209.38:80 killredls.pw tcp
US 172.67.209.38:80 killredls.pw tcp
US 172.67.209.38:80 killredls.pw tcp
US 172.67.209.38:80 killredls.pw tcp
US 172.67.209.38:80 killredls.pw tcp
US 172.67.209.38:80 killredls.pw tcp
US 172.67.209.38:80 killredls.pw tcp
US 172.67.209.38:80 killredls.pw tcp
US 172.67.209.38:80 killredls.pw tcp
US 172.67.209.38:80 killredls.pw tcp
US 172.67.209.38:80 killredls.pw tcp
US 172.67.209.38:80 killredls.pw tcp
US 8.8.8.8:53 api.steampowered.com udp
JP 23.207.106.113:443 api.steampowered.com tcp
JP 23.207.106.113:443 api.steampowered.com tcp
US 18.239.36.22:443 static-assets-prod.unrealengine.com tcp
US 18.239.36.22:443 static-assets-prod.unrealengine.com tcp
US 172.67.209.38:80 killredls.pw tcp
US 8.8.8.8:53 b.stats.paypal.com udp
US 64.4.245.84:443 b.stats.paypal.com tcp
US 64.4.245.84:443 b.stats.paypal.com tcp
US 8.8.8.8:53 www.recaptcha.net udp
NL 142.250.179.163:443 www.recaptcha.net tcp
NL 142.250.179.163:443 www.recaptcha.net tcp
US 172.67.209.38:80 killredls.pw tcp
US 8.8.8.8:53 84.245.4.64.in-addr.arpa udp
US 8.8.8.8:53 163.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 171.252.72.23.in-addr.arpa udp
US 192.55.233.1:443 tcp
US 172.67.209.38:80 killredls.pw tcp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 192.55.233.1:443 tcp
US 20.189.173.21:443 watson.telemetry.microsoft.com tcp
US 172.67.209.38:80 killredls.pw tcp
US 8.8.8.8:53 c6.paypal.com udp
JP 23.207.106.113:443 api.steampowered.com tcp
JP 23.207.106.113:443 api.steampowered.com tcp
US 8.8.8.8:53 dub.stats.paypal.com udp
US 151.101.1.35:443 c6.paypal.com tcp
US 151.101.1.35:443 c6.paypal.com tcp
US 64.4.245.84:443 dub.stats.paypal.com tcp
US 64.4.245.84:443 dub.stats.paypal.com tcp
US 172.67.209.38:80 killredls.pw tcp
US 172.67.209.38:80 killredls.pw tcp
US 8.8.8.8:53 21.173.189.20.in-addr.arpa udp
US 172.67.209.38:80 killredls.pw tcp
US 172.67.209.38:80 killredls.pw tcp
US 8.8.8.8:53 talon-website-prod.ecosec.on.epicgames.com udp
US 172.64.146.120:443 talon-website-prod.ecosec.on.epicgames.com tcp
US 172.64.146.120:443 talon-website-prod.ecosec.on.epicgames.com tcp
US 172.67.209.38:80 killredls.pw tcp
US 172.67.209.38:80 killredls.pw tcp
US 8.8.8.8:53 120.146.64.172.in-addr.arpa udp
US 172.67.209.38:80 killredls.pw tcp
US 172.67.209.38:80 killredls.pw tcp
US 172.67.209.38:80 killredls.pw tcp
US 8.8.8.8:53 talon-service-prod.ecosec.on.epicgames.com udp
US 104.18.41.136:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 104.18.41.136:443 talon-service-prod.ecosec.on.epicgames.com tcp
RU 5.42.92.51:19057 tcp
US 8.8.8.8:53 js.hcaptcha.com udp
US 104.19.218.90:443 js.hcaptcha.com tcp
US 104.19.218.90:443 js.hcaptcha.com tcp
US 8.8.8.8:53 136.41.18.104.in-addr.arpa udp
US 8.8.8.8:53 90.218.19.104.in-addr.arpa udp
US 8.8.8.8:53 newassets.hcaptcha.com udp
US 104.19.218.90:443 newassets.hcaptcha.com tcp
US 104.19.218.90:443 newassets.hcaptcha.com tcp
US 8.8.8.8:53 api.hcaptcha.com udp
US 104.19.219.90:443 api.hcaptcha.com tcp
US 104.19.219.90:443 api.hcaptcha.com tcp
US 8.8.8.8:53 90.219.19.104.in-addr.arpa udp
RU 5.42.92.190:80 5.42.92.190 tcp
US 8.8.8.8:53 190.92.42.5.in-addr.arpa udp
US 8.8.8.8:53 161.19.199.152.in-addr.arpa udp
NL 194.169.175.118:80 194.169.175.118 tcp
US 8.8.8.8:53 118.175.169.194.in-addr.arpa udp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.251.36.54:443 i.ytimg.com tcp
NL 142.251.36.54:443 i.ytimg.com tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 20.42.73.29:443 watson.telemetry.microsoft.com tcp
RU 5.42.92.51:19057 tcp
US 8.8.8.8:53 29.73.42.20.in-addr.arpa udp
NL 142.251.36.54:443 i.ytimg.com tcp
NL 142.251.36.54:443 i.ytimg.com tcp
RU 5.42.92.190:80 5.42.92.190 tcp
US 20.42.73.29:443 watson.telemetry.microsoft.com tcp
IT 185.196.9.161:80 185.196.9.161 tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 161.9.196.185.in-addr.arpa udp
RU 5.42.64.16:443 tcp
US 8.8.8.8:53 16.64.42.5.in-addr.arpa udp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 52.168.117.173:443 watson.telemetry.microsoft.com tcp
FI 77.91.68.247:80 77.91.68.247 tcp
US 8.8.8.8:53 247.68.91.77.in-addr.arpa udp
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 20.42.65.92:443 watson.telemetry.microsoft.com tcp
US 8.8.8.8:53 92.65.42.20.in-addr.arpa udp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 20.189.173.22:443 watson.telemetry.microsoft.com tcp
US 8.8.8.8:53 22.173.189.20.in-addr.arpa udp
RU 5.42.92.51:19057 tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
RU 5.42.92.190:80 5.42.92.190 tcp
NL 142.251.36.54:443 i.ytimg.com tcp
NL 142.251.36.54:443 i.ytimg.com tcp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 52.182.143.212:443 watson.telemetry.microsoft.com tcp
US 8.8.8.8:53 212.143.182.52.in-addr.arpa udp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 52.168.117.173:443 watson.telemetry.microsoft.com tcp
US 8.8.8.8:53 bluepablo.fun udp
US 172.67.180.92:80 bluepablo.fun tcp
US 8.8.8.8:53 92.180.67.172.in-addr.arpa udp
US 172.67.180.92:80 bluepablo.fun tcp
US 8.8.8.8:53 122.10.44.20.in-addr.arpa udp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
NL 157.240.247.35:443 www.facebook.com tcp
NL 157.240.247.35:443 www.facebook.com tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 52.182.143.212:443 watson.telemetry.microsoft.com tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
RU 5.42.92.51:19057 tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
RU 5.42.92.190:80 5.42.92.190 tcp
US 194.49.94.72:80 194.49.94.72 tcp
US 172.67.180.92:80 bluepablo.fun tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 72.94.49.194.in-addr.arpa udp
US 194.49.94.11:80 194.49.94.11 tcp
US 8.8.8.8:53 11.94.49.194.in-addr.arpa udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
US 95.214.26.28:80 host-host-file8.com tcp
US 8.8.8.8:53 28.26.214.95.in-addr.arpa udp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.13.31:443 api.ip.sb tcp
US 8.8.8.8:53 31.13.26.104.in-addr.arpa udp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 20.189.173.21:443 watson.telemetry.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ty1lD96.exe

MD5 91994eda7b19c22716797ece4e351532
SHA1 dcc485784bddc69ca370f7c93581683af8da3c33
SHA256 0014e43c2f6e18936b4d98fb9a6c3bc8be04009e5407d8a4489aca76295db724
SHA512 da7ea73b274ac0814f0e713ecfbacdf90dd878fc9e1f982b2d6e6b092d8918877c0f3765c85b8b4c7dff59aec5c69c11d958cddb9274ff13df637097fda53e45

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ty1lD96.exe

MD5 91994eda7b19c22716797ece4e351532
SHA1 dcc485784bddc69ca370f7c93581683af8da3c33
SHA256 0014e43c2f6e18936b4d98fb9a6c3bc8be04009e5407d8a4489aca76295db724
SHA512 da7ea73b274ac0814f0e713ecfbacdf90dd878fc9e1f982b2d6e6b092d8918877c0f3765c85b8b4c7dff59aec5c69c11d958cddb9274ff13df637097fda53e45

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\LW2uf85.exe

MD5 7763de47008b5dc131c5c077873eeda0
SHA1 d6da7ac91cbfe60cf506340016ea5634718dde95
SHA256 211696746e53e700a63dcc9dfcf7450690e0b55b8228106179e26fac0cad40bd
SHA512 2716daf2a872d81723ddb43b196044d813fba3f8b2337f4e1d4212bf79dfeca57294c088d7e4015dcaf7861ae55f21c515c1dee4dbddc0aa9201a6974fdff8b0

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\LW2uf85.exe

MD5 7763de47008b5dc131c5c077873eeda0
SHA1 d6da7ac91cbfe60cf506340016ea5634718dde95
SHA256 211696746e53e700a63dcc9dfcf7450690e0b55b8228106179e26fac0cad40bd
SHA512 2716daf2a872d81723ddb43b196044d813fba3f8b2337f4e1d4212bf79dfeca57294c088d7e4015dcaf7861ae55f21c515c1dee4dbddc0aa9201a6974fdff8b0

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uI1ds80.exe

MD5 95c796c86c9bc62db3656df59a6fb898
SHA1 a48fed29cdbece4b01a0c40716acb39bc3615a57
SHA256 b2974494d2139b10f2564c6506ff1eb2be87c72e538541aa93dd75da443ee0f6
SHA512 3c64d63bd80a5b6433af392ebd115ca2627a9c3e9d5a32a6011d1c0fc82e4a6e9a54c2fa559169fb6e70f5808444036ddc2ac5ecfd010d72605517b280ac6e8a

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uI1ds80.exe

MD5 95c796c86c9bc62db3656df59a6fb898
SHA1 a48fed29cdbece4b01a0c40716acb39bc3615a57
SHA256 b2974494d2139b10f2564c6506ff1eb2be87c72e538541aa93dd75da443ee0f6
SHA512 3c64d63bd80a5b6433af392ebd115ca2627a9c3e9d5a32a6011d1c0fc82e4a6e9a54c2fa559169fb6e70f5808444036ddc2ac5ecfd010d72605517b280ac6e8a

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1go07xH9.exe

MD5 cad4cd3b754a90538e9d0dd6c2ead523
SHA1 92f77b19a1f63df7ddf5d618112e740df80ec149
SHA256 c6b248014b728eb029a37ecc687627f3a802b4e5d815fb15b114eb8075e58428
SHA512 cc8a33e266618a078c212f11785e4de6b8c644f3ee9cac0b05b5e70634b49f5d1c6a529c1ef3d0844342bebe9867675093e264ede3f24ffaa56c4bb22a011175

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1go07xH9.exe

MD5 cad4cd3b754a90538e9d0dd6c2ead523
SHA1 92f77b19a1f63df7ddf5d618112e740df80ec149
SHA256 c6b248014b728eb029a37ecc687627f3a802b4e5d815fb15b114eb8075e58428
SHA512 cc8a33e266618a078c212f11785e4de6b8c644f3ee9cac0b05b5e70634b49f5d1c6a529c1ef3d0844342bebe9867675093e264ede3f24ffaa56c4bb22a011175

memory/864-28-0x0000024A14C00000-0x0000024A14C10000-memory.dmp

memory/864-44-0x0000024A14D00000-0x0000024A14D10000-memory.dmp

memory/864-63-0x0000024A143B0000-0x0000024A143B2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2IX3959.exe

MD5 c00b3416e4108868945091c1b26cb4df
SHA1 0ad8aab58ea06a10a5e4f6a94da906b4b3a5b312
SHA256 8bff02597a11036aabd7aacf5bcc040a13896b0ab05d333f2b2daf45a472e43b
SHA512 48d5f6d22317678dc4e1e39116ed87f63d333e837c5449a95cc00607540f1bc16a6bc8cb85aabb137cf7ff28092363ecec730dbd6595ee690d1eccf7b616e124

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2IX3959.exe

MD5 c00b3416e4108868945091c1b26cb4df
SHA1 0ad8aab58ea06a10a5e4f6a94da906b4b3a5b312
SHA256 8bff02597a11036aabd7aacf5bcc040a13896b0ab05d333f2b2daf45a472e43b
SHA512 48d5f6d22317678dc4e1e39116ed87f63d333e837c5449a95cc00607540f1bc16a6bc8cb85aabb137cf7ff28092363ecec730dbd6595ee690d1eccf7b616e124

memory/2880-75-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2880-78-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2880-79-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2880-81-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7NA21Vg.exe

MD5 b938034561ab089d7047093d46deea8f
SHA1 d778c32cc46be09b107fa47cf3505ba5b748853d
SHA256 260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161
SHA512 4909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7NA21Vg.exe

MD5 b938034561ab089d7047093d46deea8f
SHA1 d778c32cc46be09b107fa47cf3505ba5b748853d
SHA256 260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161
SHA512 4909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b

memory/1844-85-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

MD5 1bfe591a4fe3d91b03cdf26eaacd8f89
SHA1 719c37c320f518ac168c86723724891950911cea
SHA256 9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
SHA512 02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

MD5 0fd40a617ebd2b314073662722672f51
SHA1 db6a8e201d804f663eabf3937d0f20aa481a5d5b
SHA256 1e4870035091692ccb3f692809f1c28fcf224beb1fe7707920291133a6b44af2
SHA512 e00d980cdd3115fad36ef89156a05e50ded4f96973bcb9bfd41255341f6d25fa838cbf3b799014464df6cfd82379c2a3e1fa9e8d83012899ff7a96e2984b1a39

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 5f70a873f27939298e2bc136573a7217
SHA1 57995e188fa7fb4d6e8a07903e7b5f21ed675165
SHA256 3ca2361584ad9eb5e8216cf4060ea235cf16ae65f15a782e95db83625c0e6f98
SHA512 e573f071093ed68c7265d2e53a6a7b7a271d7218c5508164f92034d41079f85e356d4c7b63ae93cb7830d97cbd584c1e38d793cae5db5201941f41fd11eabf91

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 202c6d08618821679870b09397b327d4
SHA1 95825d16b996f7ecd314ac66d68a7e166eb79b1e
SHA256 6cf0733f28bcebd3e25d33cc117773633a70241665ef8774fa42201161091bb9
SHA512 2eec22005e9d9fd31374ee153b4adb3b47cdac1c08fae3a28b127fbcb2060b708392fa4e9326a80126c3633392dcd6f048d067787d6e2d792d08a3c745c01318

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

MD5 80144ac74f3b6f6d6a75269bdc5d5a60
SHA1 6707bb0c8a3e92d1fd4765e10781535433036196
SHA256 d746128fdb817742cb812c74fb8aa543191116feda6dfcfc59d74becf482a285
SHA512 c61d3847bdc0c4a4b8cd94b2d9a3a474b985b974776ca2ef4caf78e5fb82e4d4f65c477dec1cdf080f9d397f3d0dfe035adc267f9b4fe9b75c82e399f20bc6b3

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

MD5 f16f3d5dda2279a95cd6f33f9d8d24d0
SHA1 0ab35bc8d00ca2501ea8159f9d0b3e0fa5935348
SHA256 b681c0b122c7d0ffe5b3c1c28c357871bdbfab7e81e5da04f1223caca8f0137f
SHA512 aa3cd52efe71be7a8a91965623a77976fb529c226da4a64198fcc6c728a2b91980a7a2076bd26ca58be82c28834910e3f1bea36869dc1a32182897d62d999841

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

MD5 f16f3d5dda2279a95cd6f33f9d8d24d0
SHA1 0ab35bc8d00ca2501ea8159f9d0b3e0fa5935348
SHA256 b681c0b122c7d0ffe5b3c1c28c357871bdbfab7e81e5da04f1223caca8f0137f
SHA512 aa3cd52efe71be7a8a91965623a77976fb529c226da4a64198fcc6c728a2b91980a7a2076bd26ca58be82c28834910e3f1bea36869dc1a32182897d62d999841

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 2802b243b4db0007a7ae0c5226b1dce2
SHA1 72842c1d72ace5e33b7d0c4085223f60866de31e
SHA256 183b637307f6b761fa46553f5ce73abc31dcf1d1f17cbe01f494ae5bb7ab76cf
SHA512 08f6dee117b69f95ef09f7149fb6af3a6ce85c73c9663a742d7a67874769cbacd1a134ab08505ae98c85d0e9381d6a5d7d0df028cdb923ce5c6221cd8fcf814d

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC

MD5 df26803bd741cd8337ebbee4c99100c7
SHA1 0c773c5482f47ed25356739cfae0e0d1f1655d73
SHA256 fd20571a9005f781b6452d345b8ea3e90c9cc88156795a3521cc16fae542355e
SHA512 6648aa7a8c307467e3174b50928aa19aa133f42a87b6332ef02aad85fe1b48b848145daba50ef220eb075699268547eb7a731874cdb197d89cd229f4cc962886

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC

MD5 bb07f125993b74d793f2d5f99f0d93d4
SHA1 bc3fed0ce960e4808ec150acfacd4cd8c9ea6020
SHA256 88461ac612842c68e97280b7b2153ad0facb606cdadcd3e7b2bc0847f73d7d3a
SHA512 39b55b1734a9487d0c3cc63239baa86ce2f4439169093d91a5c7de79fd36803d98f84c818c73841eb6d2e661856c3369e6593b60a326b9ca1bba97a6e2005686

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC

MD5 ac63806548569884c7884b0a27e20c85
SHA1 337c1070e98cf1daa9efa769afc6a1d8677213d9
SHA256 1a85dc0cd8d23272f6583797b69cfe3f165afbb4d9111084e0e9d5d7205f7bd8
SHA512 68f5aa7067bce9a29565a02360af1fbdbdb7210897f60639f3370ab510bd4e850876a4dd8e5a53f77242016f4c79fc8d3c084f61b3520ac3295009382a015ae1

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC

MD5 ac63806548569884c7884b0a27e20c85
SHA1 337c1070e98cf1daa9efa769afc6a1d8677213d9
SHA256 1a85dc0cd8d23272f6583797b69cfe3f165afbb4d9111084e0e9d5d7205f7bd8
SHA512 68f5aa7067bce9a29565a02360af1fbdbdb7210897f60639f3370ab510bd4e850876a4dd8e5a53f77242016f4c79fc8d3c084f61b3520ac3295009382a015ae1

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\1IG0WHFN.cookie

MD5 89f2765add620657dea29862bf003b29
SHA1 857cd799f9232044f3f4f467f54c3d5332f47d83
SHA256 d9af8dfc11e173c46ef7a9cd0ce3e0d53690b48ba14ba73fdd0dc43a6f52d237
SHA512 be3b7d292d194ba5369f42718045c46fd1c42908f244c40ef02d466640a61ffa6f3765e04dc8740cfa2d3abba73e855df08768466b861582b85be8068cfcc982

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5 bbf0e29268ddfd99bde03e58039df96a
SHA1 3ba0542fed7734b1fcb484d73df8583d4c1cb11d
SHA256 ccb67510824670f69ce2ed17ba72455f2be26d053ab13b2d04e8c4bbc2a456a4
SHA512 4eac0c845359016b7045100c146d83b3c5e94ca7d319e4bcde9c19f880b89d33630aadbfbeb21c85295388826e046857aafba5b55fd22397537761586af0df35

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5 8a07c590d8b67351681cbcfb82c344ef
SHA1 6ba49d1aaf61fabd3e275df6c4ada60cb16be265
SHA256 fd5d0a65a6fe8ed8e7febcf1e68e3f53cb38d61a069049109504ae41253a01f0
SHA512 8465f6ec51e5e5ed68be6af60d51678c4de2546f77c761ac04caf3853282114ead71d86456bdc41b91a0761c9c0d10b54eccb7faec9df771d27a4a94c1bb74ec

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\QJ25BZK0.cookie

MD5 12dc44432623261a1644c87fd692f754
SHA1 c4b2b028fbe14129a2433c1381a3900280ad172b
SHA256 79c9aff88cb9dab07fd797f5c255d37b11adc61f74bedc032b2e5c38427c9b2d
SHA512 45ca3d7b70fab42a3c3c4ff5cdddcaa79105258e4324bde2634221e05e289ed15895edaf1b3c04cbb203275f921c108bb5968144060172558046320ac23f38d9

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7S1G3AKA\shared_global[1].css

MD5 eec4781215779cace6715b398d0e46c9
SHA1 b978d94a9efe76d90f17809ab648f378eb66197f
SHA256 64f61829703eca976c04cf194765a87c5a718e98597df2cb3eae9cf3150e572e
SHA512 c1f8164eb3a250a8edf8b7cb3b8c30396861eff95bcc4ed9a0c92a9dcde8fd7cd3a91b8f4fd8968c4fdafd18b51d20541bcc07a0643e55c8f6b12ceb67d7805d

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7S1G3AKA\buttons[1].css

MD5 84524a43a1d5ec8293a89bb6999e2f70
SHA1 ea924893c61b252ce6cdb36cdefae34475d4078c
SHA256 8163d25cb71da281079b36fcde6d9f6846ff1e9d70112bbe328cae5ffb05f2bc
SHA512 2bf17794d327b4a9bdbae446dd086354b6b98ac044a8ee0b85bd72c3ab22d93b43f3542df03d64f997d1df6fc6cac5c5e258c4ec82b998f3a40b50c2fde99b5a

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

MD5 f16f3d5dda2279a95cd6f33f9d8d24d0
SHA1 0ab35bc8d00ca2501ea8159f9d0b3e0fa5935348
SHA256 b681c0b122c7d0ffe5b3c1c28c357871bdbfab7e81e5da04f1223caca8f0137f
SHA512 aa3cd52efe71be7a8a91965623a77976fb529c226da4a64198fcc6c728a2b91980a7a2076bd26ca58be82c28834910e3f1bea36869dc1a32182897d62d999841

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7S1G3AKA\shared_responsive[1].css

MD5 086f049ba7be3b3ab7551f792e4cbce1
SHA1 292c885b0515d7f2f96615284a7c1a4b8a48294a
SHA256 b38fc1074ef68863c2841111b9e20d98ea0305c1e39308dc7ad3a6f3fd39117a
SHA512 645f23b5598d0c38286c2a68268cb0bc60db9f6de7620297f94ba14afe218d18359d124ebb1518d31cd8960baed7870af8fd6960902b1c9496d945247fbb2d78

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 202c6d08618821679870b09397b327d4
SHA1 95825d16b996f7ecd314ac66d68a7e166eb79b1e
SHA256 6cf0733f28bcebd3e25d33cc117773633a70241665ef8774fa42201161091bb9
SHA512 2eec22005e9d9fd31374ee153b4adb3b47cdac1c08fae3a28b127fbcb2060b708392fa4e9326a80126c3633392dcd6f048d067787d6e2d792d08a3c745c01318

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 274002bf8c283b7ecb949ae19d73b9df
SHA1 b9f08e3b0ebb21c0e4ef5dae7ece37c459c824f6
SHA256 c8ca0eb064588d1fe96330d931df19ea77cad088a8c32dfdf99a7f1fabd9efde
SHA512 6aa6780e3c57521e46a43bae353b49f957969332bdbe086f506f920357517e358702bac3899ba78bef6fe334fcce8ec72ec2bfe15ac75f0ddcfbb3bd1c6bb586

memory/2716-354-0x00000222DDCB0000-0x00000222DDCB2000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

MD5 1bfe591a4fe3d91b03cdf26eaacd8f89
SHA1 719c37c320f518ac168c86723724891950911cea
SHA256 9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
SHA512 02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

memory/1844-364-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2716-377-0x00000222DDCE0000-0x00000222DDCE2000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC

MD5 ac63806548569884c7884b0a27e20c85
SHA1 337c1070e98cf1daa9efa769afc6a1d8677213d9
SHA256 1a85dc0cd8d23272f6583797b69cfe3f165afbb4d9111084e0e9d5d7205f7bd8
SHA512 68f5aa7067bce9a29565a02360af1fbdbdb7210897f60639f3370ab510bd4e850876a4dd8e5a53f77242016f4c79fc8d3c084f61b3520ac3295009382a015ae1

memory/3296-351-0x00000000009B0000-0x00000000009C6000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC

MD5 df26803bd741cd8337ebbee4c99100c7
SHA1 0c773c5482f47ed25356739cfae0e0d1f1655d73
SHA256 fd20571a9005f781b6452d345b8ea3e90c9cc88156795a3521cc16fae542355e
SHA512 6648aa7a8c307467e3174b50928aa19aa133f42a87b6332ef02aad85fe1b48b848145daba50ef220eb075699268547eb7a731874cdb197d89cd229f4cc962886

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\8yo518RN.exe

MD5 6c48bad9513b4947a240db2a32d3063a
SHA1 a5b9b870ce2d3451572d88ff078f7527bd3a954a
SHA256 984ae46ad062442c543fcdb20b1a763001e7df08eb0ab24fc490cbf1ab4e54c8
SHA512 7ae5c7bce222cfeb9e0fae2524fd634fa323282811e97a61c6d1e9680d025e49b968e72ca8ce2a2ceca650fa73bc05b7cf578277944305ed5fae2322ef7d496f

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7S1G3AKA\tooltip[1].js

MD5 72938851e7c2ef7b63299eba0c6752cb
SHA1 b75196bd3a6f9f4dfc1bbf5e43e96874bcd9ce4e
SHA256 e2d4e0e1d3e162fdc815f16dfff9ae9b0a967949f0f3ae371f947d730a3f0661
SHA512 2bb6c03a1335ef9514d0d172a4284d82a29d1783a72306bdcb8af3185d5cd2ff16303355aa4b05086d2fa0b5b7c7159cfa67de4a6175095ff0e68adec2a56ac1

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\8yo518RN.exe

MD5 6c48bad9513b4947a240db2a32d3063a
SHA1 a5b9b870ce2d3451572d88ff078f7527bd3a954a
SHA256 984ae46ad062442c543fcdb20b1a763001e7df08eb0ab24fc490cbf1ab4e54c8
SHA512 7ae5c7bce222cfeb9e0fae2524fd634fa323282811e97a61c6d1e9680d025e49b968e72ca8ce2a2ceca650fa73bc05b7cf578277944305ed5fae2322ef7d496f

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\RSONDYW3\shared_global[1].js

MD5 f94199f679db999550a5771140bfad4b
SHA1 10e3647f07ef0b90e64e1863dd8e45976ba160c0
SHA256 26c013d87a0650ece1f28cdc42d7995ad1a57e5681e30c4fd1c3010d995b7548
SHA512 66aef2dda0d8b76b68fd4a90c0c8332d98fe6d23590954a20317b0129a39feb9cd3bd44e0c57e6b309227d912c6c07b399302a5e680615e05269769b7e750036

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\NISZ8A46.cookie

MD5 ca323a89739ef24ff50b1917c821d345
SHA1 95e427dd180873bbcbf1d59e94035767257418d1
SHA256 50af979249cfba4e5a8f182a9cb8270cc73f6cfd79162a85141f1cc5bad746bb
SHA512 8844ad3500f361bb552e5e03b0c0c17bc386f6cb216f8a9ced9d56628222ae261c6ed22b0e6fea5948c5582fff13cdd652d44b13b72185a07ca0ebd17cd1adf8

memory/5596-418-0x0000000000400000-0x000000000043C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\9mE4sQ5.exe

MD5 33cab8751687bb3d8d895a35c8ac9b8c
SHA1 7fda584661867f3fb586665c2dfad1777d50f491
SHA256 406889bdac2bc95ee515f8edd14858e0845142b0f43eab2fb6023243057ce414
SHA512 034d263d65c0da965a6a5e081b7ac8d215e291a7e8263f576da25fbeb539ee709c8e3f765b5477e422509c99367aa18c2ea5c43497b845f585988a655d9e3d82

memory/4956-437-0x000001854E440000-0x000001854E460000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\9mE4sQ5.exe

MD5 33cab8751687bb3d8d895a35c8ac9b8c
SHA1 7fda584661867f3fb586665c2dfad1777d50f491
SHA256 406889bdac2bc95ee515f8edd14858e0845142b0f43eab2fb6023243057ce414
SHA512 034d263d65c0da965a6a5e081b7ac8d215e291a7e8263f576da25fbeb539ee709c8e3f765b5477e422509c99367aa18c2ea5c43497b845f585988a655d9e3d82

memory/5596-445-0x00000000726D0000-0x0000000072DBE000-memory.dmp

memory/5596-448-0x000000000BE90000-0x000000000C38E000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\CBIF1YGB.cookie

MD5 2aee2b7c6f1fc2b9e35d06f3ea45a291
SHA1 9ea8a4104f4bc99d1b69c6fd88132d13fc39e625
SHA256 c1471da24f95f93efb63ad457586989d776769f8ace6536af19207ce1b4b2131
SHA512 aa3239050b441a3787228596a0d768a8c1dae426b4411d7087ae168f6165f1b6087796b2dc71b9f986c6c531421be01a45dad62a5c4d411f5947036b35c0d8d7

memory/5596-450-0x000000000BA30000-0x000000000BAC2000-memory.dmp

memory/4636-453-0x0000021B7E330000-0x0000021B7E350000-memory.dmp

memory/5596-460-0x000000000B9D0000-0x000000000B9DA000-memory.dmp

memory/864-465-0x0000024A1BAB0000-0x0000024A1BAB1000-memory.dmp

memory/864-467-0x0000024A1BAC0000-0x0000024A1BAC1000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\RSONDYW3\shared_responsive_adapter[1].js

MD5 a52bc800ab6e9df5a05a5153eea29ffb
SHA1 8661643fcbc7498dd7317d100ec62d1c1c6886ff
SHA256 57cfaf9b92c98541f769090cd0229a30013cea7cfafc18519ca654bfae29e14e
SHA512 1bcacd0ec7c3d633d6296fff3325802d6352805f0d2cf1eea39237424229ecffad6cb2aee4248e28b1eca02ff0646b58240851a246bbcf0aa1083830d5d9081e

memory/5596-482-0x000000000C9A0000-0x000000000CFA6000-memory.dmp

memory/5596-486-0x000000000BD50000-0x000000000BE5A000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\196FL80X.cookie

MD5 c5104c7605f56424ad20b45df7fe5037
SHA1 2859d1c8f4a824d24605e6d1d6096105d9bf01ef
SHA256 0a8bd053bca5b9b71f82cbb76613a56ab8e36e6e5aa6f9b089263cfc3d1c75b1
SHA512 f45c519349e6be2af048422051a6d46bf72911db4db9bdeb28fc2051359c4cd1c73e19aebeb11f1992616180a35fa2f75a8ab79ddd8ab2de602dcfc074f368ef

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\XQRHPSW9.cookie

MD5 1776cd23cb54a2f445918aa0ebc91a77
SHA1 77a1438b664c376e5bc570232ea89e5b94a6fd48
SHA256 80105053fbc3e52df3ef70089faf3568987b71b7c48fcac08ccf95ba466b3913
SHA512 d1dfe4af2dcec2cecbead924caacf1af00fcce132530c36dd25017124a5af47dcd48cbe328d81aa010548b25a7fdb8496fcfe420cc6877e99bc0bc9873b5739a

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\0GPDBRJR.cookie

MD5 11794377ea040861dcb005199c63ec2a
SHA1 979ff9d2abf441573f627362913845a321656ab8
SHA256 abbcde713b6b9ccad1494bf967cdfb59f9672ba02b1aa1a8672ca04c80964403
SHA512 6d6c943ab0034bb7d5d304f7c30711faa2d70b75cbe5f4ba5cadbe0e0c1d6d3a93fad77efae62ec3840df11760ab3a5f425211c92c341dd21e52ab76245fbf4d

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\XLVR71YA.cookie

MD5 1c729c23d7a585fb66747bfc032cfe58
SHA1 020e4af7df7f23d95c59a3c9c5f2f0d7d90f9203
SHA256 3cae16569eb3de3e878e952cbcb4be82a5d86902bfbe208be56e966208a71ddf
SHA512 f80a7c07bbf316e684fb81fc3173c3a1a4dea4344947b5c10ceb07a47560ac84b0ddbc3e235ecd2606f8d67c429ddaffbab9e6c02786eede7bcfacebbc69b307

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\ZDEBT701.cookie

MD5 ec84e3958dbc36e9ecb61d9b2eb36eb1
SHA1 ae61be8b8210a7c12b90e2291a477d3167fe7b4e
SHA256 386ed713b60e009eefb5451592c662baadbb3ed6228755db508f8d151b08449d
SHA512 fe02be89e414d95d9b91b24bd9a07640fe2a5598c50d1da3b6c4948a9348e49f8ee62f2754723c65f01fbe510321f5e3aa434daca3c1ddbd984272e4592da3c0

memory/5596-512-0x000000000BC40000-0x000000000BC52000-memory.dmp

memory/5728-511-0x0000000000400000-0x0000000000488000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\OQOKL6JR\favicon[1].ico

MD5 630d203cdeba06df4c0e289c8c8094f6
SHA1 eee14e8a36b0512c12ba26c0516b4553618dea36
SHA256 bbce71345828a27c5572637dbe88a3dd1e065266066600c8a841985588bf2902
SHA512 09f4e204960f4717848bf970ac4305f10201115e45dd5fe0196a6346628f0011e7bc17d73ec946b68731a5e179108fd39958cecf41125f44094f63fe5f2aeb2c

memory/5728-524-0x0000000000400000-0x0000000000488000-memory.dmp

memory/5596-521-0x000000000BC60000-0x000000000BC9E000-memory.dmp

memory/5728-527-0x0000000000400000-0x0000000000488000-memory.dmp

memory/5596-529-0x000000000BCA0000-0x000000000BCEB000-memory.dmp

memory/5728-534-0x0000000000400000-0x0000000000488000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\MLYS8BJX.cookie

MD5 827f350c3dda80bd196c8ae7f37a58a4
SHA1 0dc74845c7d51f76770234c3d16d95ee17035de3
SHA256 cfbd937b00591062c6a656b261f02fbe3d62c3ffc590ad43f0601e5df69bcc92
SHA512 737520ceeecad30dcb39da003c30bc7c78fa170f880fd91a315cb8425262f17c37eec97edec58a00a8552f2b641ef4118ba15cac6cf378503d62d4391841af73

memory/796-568-0x000001D015440000-0x000001D015460000-memory.dmp

memory/796-581-0x000001D013160000-0x000001D013180000-memory.dmp

memory/4488-582-0x00000209AD900000-0x00000209AD902000-memory.dmp

memory/4488-587-0x00000209AD920000-0x00000209AD922000-memory.dmp

memory/4488-592-0x00000209AD9E0000-0x00000209AD9E2000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\7UEJX3VG.cookie

MD5 17cb61bb5f857fc5a7ab9c0b11f63ef6
SHA1 dafec6edb68fad8a55243da909c32b3707307c75
SHA256 8e538c44dbeaf1e841c4581e3ea6de69078c00d5677a293a38ad4415acf4a1da
SHA512 2788149a5e52ceae2b8cffc779d9aee5411c8a8e856faf84f1da79deea007d8af9390e854f6acda27a4ae9f86eea44134a89b59aff4f9d1a82e7245b7f36df27

memory/4636-617-0x0000021300800000-0x0000021300900000-memory.dmp

memory/4636-643-0x0000021300800000-0x0000021300900000-memory.dmp

memory/4636-650-0x0000021B7FC90000-0x0000021B7FCB0000-memory.dmp

memory/796-674-0x000001D013600000-0x000001D013700000-memory.dmp

memory/4956-693-0x000001854F8E0000-0x000001854F900000-memory.dmp

memory/5228-706-0x0000021F7F840000-0x0000021F7F860000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\BZIH464P\www.epicgames[1].xml

MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\MVPWEI5B.cookie

MD5 5878f1d323280fc7c851ec1974c3f5a7
SHA1 15460bcc30a4078163b5af558ddf9d54dcb39ffe
SHA256 3c50c6c13e4c0a52655d77231b70876b396f15858700adf1db28e5b94160278d
SHA512 a6c139765c1de9139370f6f1b8074c462db4783a93a5160c9a35868bf08f6fcf5bc5334170b1636b35491083f90444697f1bd774fc7cf6f5945c98e872981c14

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_57DB0353F73BFEAADC2A8A5ECA70ACE8

MD5 42543f480eb00f895387212a369b1075
SHA1 aa04603bbd708a4727befd7b8f354f23d5953f4a
SHA256 f0872218ff6e9878a0d0772d60c56638f7c5932a717598e239494f597561b95d
SHA512 197c197044c0446c0e7e21aeae8daad060ad24f2f879b6227e4b90449b73968a41cb7f724387c11345bf11758c5194dc6b6a889367873bc2c915f391c856744d

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_57DB0353F73BFEAADC2A8A5ECA70ACE8

MD5 9e05381fba1c2fc55f2e6db1543ecff0
SHA1 843dfadc095e79a514216542074128738aba3dbb
SHA256 abe294efe54daadfe39eafcec775f469617d90bf021bcc307b1720d78869d182
SHA512 3daf66e3bf1219f233a00c139a146c302316db73831677311a481d3e9430ffbe0965e52dbc2e3d5b26651f4757369be6ed368a20578c07e82f7718c23afbc529

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\2V573NUN\favicon[1].ico

MD5 231913fdebabcbe65f4b0052372bde56
SHA1 553909d080e4f210b64dc73292f3a111d5a0781f
SHA256 9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad
SHA512 7b11b709968c5a52b9b60189fb534f5df56912417243820e9d1c00c97f4bd6d0835f2cdf574d0c36ecb32dbbf5fc397324df54f7fdf9e1b062b5dbda2c02e919

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\V0A8P9ML.cookie

MD5 4e1b936a7d702098801d45279dc6c751
SHA1 cd1116a677a14799c2d8678b617343ef2776eae9
SHA256 d7f6138b7be028763de3065fb01228b43f16f21f18b425f1fcf63007b3ca9a2c
SHA512 567d2002c8b8dc4f1b314b9a3a33a33b6295f2c19ae6bf6cfbe4326c3997c0c7134a7dc2355f877e34b2485d6dcf3de12feef72b827ecc396ea195aa6af84694

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\7S1G3AKA\chunk~9229560c0[1].css

MD5 19a9c503e4f9eabd0eafd6773ab082c0
SHA1 d9b0ca3905ab9a0f9ea976d32a00abb7935d9913
SHA256 7ba0cc7d66172829eef8ff773c1e9c6e2fde3cfd82d9a89e1a71751957e47b0a
SHA512 0145582e8eb3adb98ad2dbc0b8e7a29c1d0525f0fd515fcf82eda7b4ce2f7f7f6aa0e81912aa98927e6d420ed110eb497c287a0ad483f8af067332920d4bde83

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\QCIS943E.cookie

MD5 8ed1c34a5928cdbd64b3e46d45990960
SHA1 326d5315ac30b697ab44d55e72654079d28a7b5c
SHA256 6821a641d04a4cc335059ad00cbb048b92f7d53c8ed6fdeea89e5e4ce4ab0e6c
SHA512 60ff2cfc8936db26397fd2f456239ca05e2db00f543e1ece6498df6e831d3cd7140465bcd3a492852f5c6d4c2048cd84c38da33f87cee004b9d5a293d45ad9f7

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\Q2EBIXQF.cookie

MD5 43fad5ec1263adfca84de4bb1ea4c6da
SHA1 262dde9fc07baea4c0322c364f4fd33c9316d510
SHA256 423ebdb31e58a5075a4d072cc401ac3b25ed0a23e27e5615df75b8acc0ce4c84
SHA512 e3778780de242aeef23ed17e2fe604bb6fb4f3c75eefd88129fc22ed8f3ed4e341bc0beb2a9f37bb52cbb45e3369d949ce4ae0349279cb62757b9f53e3bf16cf

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\qu64krs\imagestore.dat

MD5 c89f0c729f9926588782da70373d686a
SHA1 4008f98bb87ef5eef91899e922448054d1f17418
SHA256 6b1dbf4fd613bcf4d06d0adcbf2c489acee004c98cf4d4d479a4782b8991f96e
SHA512 b5aed5d3f3ebbd2e7f174097c6e9b7473ed64b187f53e23c6529ad3971f7742ad8a7814eeb48f501830b15786546c6acbb22589384b14ddea47c704d8c6037a5

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\2HDF9FPT.cookie

MD5 90c3ef93a1b066a0fab6dbf6bee20469
SHA1 05a632977b4fff61aa09d03e5058c57bc2c4606a
SHA256 7894529fcf589a9f91fb58c21caa0776ed57d5976d4b79cd727ff4ce3ac16b92
SHA512 516d9d9ae87a037fd6ebe85825005863b74ba9583b6ec50c83896fc0d68bf8fff2c853c16ad1b1d8da6d34203c52091cd784b7969f91619c5c127dfe02eec3d0

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\CGEXR37N.cookie

MD5 fa617f9224ce10dfbedc3eb8d53da59b
SHA1 cb1b4035799707d2ccee005d8e1a6d404aed9a8b
SHA256 411ea63aabc48ac672d2cad14c40d0ba3fa11ae4496eb0e21fbd75b999846d5d
SHA512 ccaebf874028b5abaee5c1423814a928c7d445ae246a9cd17a6445215847dd5f20e8fce19a8645887b1ce20e49f7c704ecdc3d1315d9e2186b1923244dc41eeb

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\2V573NUN\pp_favicon_x[1].ico

MD5 e1528b5176081f0ed963ec8397bc8fd3
SHA1 ff60afd001e924511e9b6f12c57b6bf26821fc1e
SHA256 1690c4e20869c3763b7fc111e2f94035b0a7ee830311dd680ac91421daad3667
SHA512 acf71864e2844907752901eeeaf5c5648d9f6acf3b73a2fb91e580bee67a04ffe83bc2c984a9464732123bc43a3594007691653271ba94f95f7e1179f4146212

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\EZ1I0ESC\B8BxsscfVBr[1].ico

MD5 e508eca3eafcc1fc2d7f19bafb29e06b
SHA1 a62fc3c2a027870d99aedc241e7d5babba9a891f
SHA256 e6d1d77403cd9f14fd2377d07e84350cfe768e3353e402bf42ebdc8593a58c9a
SHA512 49e3f31fd73e52ba274db9c7d306cc188e09c3ae683827f420fbb17534d197a503460e7ec2f1af46065f8d0b33f37400659bfa2ae165e502f97a8150e184a38c

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\7S3PSQWX\c.paypal[1].xml

MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\XUS77236.cookie

MD5 fbc7620c57a7409dbe700e0f8391b392
SHA1 aa61ef4e24961386f16e1af56dfd38ebb828c514
SHA256 0e808a8f549ab2594e6f6925bb420c89da101e28c6e21270f167583a66721179
SHA512 6ce34f8e1993e4dab420ad197f762e83b3fdcaee05e6764c8fd81460f3f339fdb166d4f82685e45183634f8e16bd4a53eac10f8bce01eacf4ebde836895e0ebf

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\UXRBSCSE\epic-favicon-96x96[1].png

MD5 c94a0e93b5daa0eec052b89000774086
SHA1 cb4acc8cfedd95353aa8defde0a82b100ab27f72
SHA256 3f51f3fb508f0d0361b722345974969576daef2c7d3db8f97c4ca8e1ff1a1775
SHA512 f676705e63f89d76520637b788f3bac96d177d1be7f9762aeb8d5d1554afd7666cbd6ef22ce08f581eb59bd383dd1971896231264bc3eaabf21135c967930240

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_57DB0353F73BFEAADC2A8A5ECA70ACE8

MD5 9e05381fba1c2fc55f2e6db1543ecff0
SHA1 843dfadc095e79a514216542074128738aba3dbb
SHA256 abe294efe54daadfe39eafcec775f469617d90bf021bcc307b1720d78869d182
SHA512 3daf66e3bf1219f233a00c139a146c302316db73831677311a481d3e9430ffbe0965e52dbc2e3d5b26651f4757369be6ed368a20578c07e82f7718c23afbc529

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\RSONDYW3\recaptcha__en[1].js

MD5 fbeedf13eeb71cbe02bc458db14b7539
SHA1 38ce3a321b003e0c89f8b2e00972caa26485a6e0
SHA256 09ed391c987b3b27df5080114e00377ff1a748793cb417a809b33f22d737fe55
SHA512 124b9f53a53ef596a54c6c04ab3be2b25d33d1ce915978ec03da8f9f294db91d41ee9091b722e462722f51f9d9455ce480e1a0cb57c2f3248c7a3a9e3b9dac58

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\O5URHGH1.cookie

MD5 43bfd1229efb51bdec7a7ca439fc1110
SHA1 43991dc5759063130555c53507c5bcceb46c09f4
SHA256 84ab66b6b93f89d6b209b35140fb97858b41e9a2630192510eb94e718179ebd0
SHA512 a79fb3633b377fcb58dd380d2c3a0ad838052c80b20aff960c075b5b1d35a86e57455c7029cbc3e164d79bfa9ca7cf328151cb56adb30f65c33b6199218c58c9

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\BZIH464P\www.recaptcha[1].xml

MD5 7837e98593383dbaa2a44039c869c85f
SHA1 d69464023bf905f28286a7edaa7f9f1de5921d99
SHA256 ca34cdbd5a8ba14f6dcaa0a715a3653dee8c28fc63336ccfe3b2da99fc97f64f
SHA512 949026405685839c53cdb908ce1abd66982545dddba3501441f5d63c577b947a5e778b875806e8db22febe3c30842097f05c5c80e0ff22b581fdfa95906b893d

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\DIHF3BBQ.cookie

MD5 9a3f78b58565769598fb6f57513b666a
SHA1 c81f610db92a78baedb3d1e01c03edb238c3f842
SHA256 24b8c757098a68cb44ca8ac2b9de0882e42973e0eba615b050ed399030d97797
SHA512 9a96c8bc21480f62147a9a17f269ecdd25abcddaf28fa66895c4b3a7bd6cebb080d09a0497cc1a7009af45cb4de568e1088d1fbd1e3abe12291d0628c38d0ab7

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\RSONDYW3\hcaptcha[1].js

MD5 c2a59891981a9fd9c791bbff1344df52
SHA1 1bd69409a50107057b5340656d1ecd6f5726841f
SHA256 6beec8b04234097105f5d7a88af9c27552b27021446c9dbe029d908d1ff8599f
SHA512 f9d556e0f7e95e603881c5196cc2aa736eb24ed62086d09d36a9e1d6b4fec9f4c1dfb125a66bec301f57230a4242108c7c255e6aa3c6f08a3a0d75e0cf288afe

C:\Users\Admin\AppData\Local\MicrosoftEdge\SharedCacheContainers\MicrosoftEdge_iecompat\IECompatData.xml

MD5 d4fc49dc14f63895d997fa4940f24378
SHA1 3efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256 853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512 cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

C:\Users\Admin\AppData\Local\Temp\C9A4.exe

MD5 557fef65be6a41dae25cc30e05cbbcf5
SHA1 1f2d15725911e8fb97556bde6ed98a883be559df
SHA256 c43ba1b96be77608af07fa060f47f99604610ea712bf71f19c2d32f70b35beb1
SHA512 e513106d493c6ca18ea5be85a8ab198f19d97edd8dd5b21fc4daafc7f27b647116efaf3366d686e158f79ad9011ca1013fac00620d366085cc04ada8ac8dc5a0

C:\Users\Admin\AppData\Local\Temp\C9A4.exe

MD5 557fef65be6a41dae25cc30e05cbbcf5
SHA1 1f2d15725911e8fb97556bde6ed98a883be559df
SHA256 c43ba1b96be77608af07fa060f47f99604610ea712bf71f19c2d32f70b35beb1
SHA512 e513106d493c6ca18ea5be85a8ab198f19d97edd8dd5b21fc4daafc7f27b647116efaf3366d686e158f79ad9011ca1013fac00620d366085cc04ada8ac8dc5a0

memory/5516-2649-0x0000000000400000-0x000000000046F000-memory.dmp

memory/5516-2660-0x00000000726D0000-0x0000000072DBE000-memory.dmp

\Users\Admin\AppData\Local\Temp\C9A4.exe

MD5 557fef65be6a41dae25cc30e05cbbcf5
SHA1 1f2d15725911e8fb97556bde6ed98a883be559df
SHA256 c43ba1b96be77608af07fa060f47f99604610ea712bf71f19c2d32f70b35beb1
SHA512 e513106d493c6ca18ea5be85a8ab198f19d97edd8dd5b21fc4daafc7f27b647116efaf3366d686e158f79ad9011ca1013fac00620d366085cc04ada8ac8dc5a0

\Users\Admin\AppData\Local\Temp\C9A4.exe

MD5 557fef65be6a41dae25cc30e05cbbcf5
SHA1 1f2d15725911e8fb97556bde6ed98a883be559df
SHA256 c43ba1b96be77608af07fa060f47f99604610ea712bf71f19c2d32f70b35beb1
SHA512 e513106d493c6ca18ea5be85a8ab198f19d97edd8dd5b21fc4daafc7f27b647116efaf3366d686e158f79ad9011ca1013fac00620d366085cc04ada8ac8dc5a0

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_11314361DFE3E655E02EC2E7F9346EC1

MD5 1876c84e711e4cba524ac353d28f6f4d
SHA1 c883eb4d579e00ea5bc7d240ef21f331266a8ecf
SHA256 e103e3e65c153f871e7d08b69afbafb99d1a921ebd2c9bc841f3f89d651e5721
SHA512 b59b132e1522bd9cc78e807101ddd19576d575dcf09e2c3b8e1af4743eacd12dc960ffc54caec8e00d73abf94f6037a42e69e9f5c250f88880a0ba03cec0ce65

memory/6892-3067-0x00000000003F0000-0x000000000108C000-memory.dmp

memory/6892-3068-0x00000000726D0000-0x0000000072DBE000-memory.dmp

memory/6792-3087-0x0000027215350000-0x000002721543E000-memory.dmp

memory/5596-3093-0x00000000726D0000-0x0000000072DBE000-memory.dmp

memory/6792-3096-0x00007FF86A710000-0x00007FF86B0FC000-memory.dmp

memory/6792-3098-0x000002722F890000-0x000002722F970000-memory.dmp

memory/4248-3100-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

memory/6792-3101-0x000002722F9E0000-0x000002722FAC0000-memory.dmp

memory/6792-3102-0x000002722F880000-0x000002722F890000-memory.dmp

memory/6392-3097-0x0000000000D90000-0x0000000000FBD000-memory.dmp

memory/6792-3104-0x000002722FAC0000-0x000002722FB88000-memory.dmp

memory/6792-3106-0x000002722FC90000-0x000002722FD58000-memory.dmp

memory/6792-3107-0x000002722FD60000-0x000002722FDAC000-memory.dmp

memory/6892-3109-0x00000000726D0000-0x0000000072DBE000-memory.dmp

memory/6308-3112-0x0000000000400000-0x00000000004AA000-memory.dmp

memory/6792-3114-0x00007FF86A710000-0x00007FF86B0FC000-memory.dmp

memory/6308-3116-0x000002447E9E0000-0x000002447EAC4000-memory.dmp

memory/6308-3117-0x00007FF86A710000-0x00007FF86B0FC000-memory.dmp

memory/6308-3118-0x000002447E9D0000-0x000002447E9E0000-memory.dmp

memory/7000-3149-0x0000000000A00000-0x0000000000B00000-memory.dmp

memory/7000-3151-0x00000000022A0000-0x00000000022A9000-memory.dmp

memory/3164-3155-0x0000000000400000-0x0000000000409000-memory.dmp

memory/6984-3180-0x0000000002A70000-0x0000000002E77000-memory.dmp

memory/6984-3183-0x0000000002E80000-0x000000000376B000-memory.dmp

memory/5516-3185-0x00000000726D0000-0x0000000072DBE000-memory.dmp

memory/6984-3187-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3164-3273-0x0000000000400000-0x0000000000409000-memory.dmp

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/6392-3607-0x0000000000D90000-0x0000000000FBD000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\OQOKL6JR\suggestions[1].en-US

MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

memory/4248-3893-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

memory/6536-3890-0x00000000044B0000-0x00000000044E6000-memory.dmp

memory/6536-3897-0x00000000726D0000-0x0000000072DBE000-memory.dmp

memory/6536-3906-0x0000000004540000-0x0000000004550000-memory.dmp

memory/6536-3904-0x0000000006BD0000-0x00000000071F8000-memory.dmp

memory/6536-3907-0x0000000004540000-0x0000000004550000-memory.dmp

memory/6536-3925-0x0000000006AE0000-0x0000000006B02000-memory.dmp

memory/6536-3933-0x00000000073E0000-0x0000000007446000-memory.dmp

memory/6536-3935-0x0000000007200000-0x0000000007266000-memory.dmp

memory/6536-3937-0x0000000007450000-0x00000000077A0000-memory.dmp

memory/6536-3966-0x0000000007870000-0x000000000788C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v2smkl23.5hj.ps1

MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

memory/6536-4056-0x0000000007C90000-0x0000000007CCC000-memory.dmp

memory/6536-4123-0x0000000008A90000-0x0000000008B06000-memory.dmp

memory/6308-4144-0x00007FF86A710000-0x00007FF86B0FC000-memory.dmp

memory/6308-4146-0x000002447E9D0000-0x000002447E9E0000-memory.dmp

memory/6796-4150-0x00007FF86A710000-0x00007FF86B0FC000-memory.dmp

memory/6796-4153-0x000001BAFC6B0000-0x000001BAFC6C0000-memory.dmp

memory/6796-4151-0x000001BAFC6B0000-0x000001BAFC6C0000-memory.dmp

memory/6796-4159-0x000001BAFC680000-0x000001BAFC6A2000-memory.dmp

memory/6536-4194-0x000000007F090000-0x000000007F0A0000-memory.dmp

memory/6536-4197-0x0000000009840000-0x0000000009873000-memory.dmp

memory/6536-4199-0x000000006C970000-0x000000006C9BB000-memory.dmp

memory/6536-4200-0x000000006B690000-0x000000006B9E0000-memory.dmp

C:\Users\Admin\AppData\Roaming\sijhhed

MD5 6f38e2c344007fa6c5a609f3baa82894
SHA1 9296d861ae076ebddac76b490c2e56fcd0d63c6d
SHA256 fb1b0639a3bdd51f914bf71948d88555e1bbb9de0937f8fa94e7aa38a8d6ab9f
SHA512 5432ab0139ee88a7b509d60ed39d3b69f7c38fe94613b3d72cc4480112d95b2cbf7652438801e7e7956aca73d6ebc870851814bec0082f4d77737a024990e059